Skip to content

Add Optional PSUseConstrainedLanguageMode rule #2165

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joshcorr wants to merge 15 commits into
base: main
Choose a base branch
from
+2,283 −27
Open

Add Optional PSUseConstrainedLanguageMode rule #2165

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
67e239a
Add UseConstrainedLanguageMode rule and tests
joshcorr Mar 7, 2026
e616116
Enhance CLM rule: restrict types, COM objects, add tests
joshcorr Mar 8, 2026
790fe8c
Enhance detection of disallowed types in CLM rule
joshcorr Mar 8, 2026
b4b566c
Detect and flag class definitions in Constrained Language
joshcorr Mar 15, 2026
f8ab608
Enhance CLM rule to check module manifests for wildcards/.ps1
joshcorr Mar 15, 2026
1be14c8
Differentiate CLM checks for signed vs unsigned scripts
joshcorr Mar 15, 2026
a23e14f
Improve dot-sourcing detection and expand CLM rule tests
joshcorr Mar 15, 2026
1abc86a
Add IgnoreSignatures option to CLM rule and improve type checks
joshcorr Mar 16, 2026
3526267
Add documentation for PSUseConstrainedLanguageMode rule
joshcorr Mar 17, 2026
d87628d
Increase severity of UseConstrainedLanguageMode to Warning for option…
joshcorr Mar 17, 2026
69b200f
Update test to expect 'Warning' severity instead of 'Info'
joshcorr Mar 17, 2026
17f1a24
Making copilot suggested edits
joshcorr Mar 17, 2026
a4a4a93
Detect and flag [PSCustomObject]@{} in CLM scripts
joshcorr Mar 17, 2026
5336b8f
Add UseConstrainedLanguageMode rule to README.md
joshcorr Mar 18, 2026
aedace7
Merge branch 'main' into addCLMRules
joshcorr Mar 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
104 changes: 77 additions & 27 deletions Rules/Strings.resx
View file
Open in desktop
Copy link
Collaborator

@bergmeister bergmeister Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you please tidy away the whitespace diff please? might be easiest to just copy paste the first 58 lines from main over this

Original file line number Diff line number Diff line change
@@ -1,17 +1,17 @@
<?xml version="1.0" encoding="utf-8"?>
<root>
<!--
Microsoft ResX Schema
<!--
Microsoft ResX Schema
Version 2.0
The primary goals of this format is to allow a simple XML format
that is mostly human readable. The generation and parsing of the
various data types are done through the TypeConverter classes
The primary goals of this format is to allow a simple XML format
that is mostly human readable. The generation and parsing of the
various data types are done through the TypeConverter classes
associated with the data types.
Comment on lines +3 to +12
Example:
... ado.net/XML headers & schema ...
<resheader name="resmimetype">text/microsoft-resx</resheader>
<resheader name="version">2.0</resheader>
Expand All @@ -26,36 +26,36 @@
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
<comment>This is a comment</comment>
</data>
There are any number of "resheader" rows that contain simple
There are any number of "resheader" rows that contain simple
name/value pairs.
Each data row contains a name, and value. The row also contains a
type or mimetype. Type corresponds to a .NET class that support
text/value conversion through the TypeConverter architecture.
Classes that don't support this are serialized and stored with the
Each data row contains a name, and value. The row also contains a
type or mimetype. Type corresponds to a .NET class that support
text/value conversion through the TypeConverter architecture.
Classes that don't support this are serialized and stored with the
mimetype set.
The mimetype is used for serialized objects, and tells the
ResXResourceReader how to depersist the object. This is currently not
The mimetype is used for serialized objects, and tells the
ResXResourceReader how to depersist the object. This is currently not
extensible. For a given mimetype the value must be set accordingly:
Note - application/x-microsoft.net.object.binary.base64 is the format
that the ResXResourceWriter will generate, however the reader can
Note - application/x-microsoft.net.object.binary.base64 is the format
that the ResXResourceWriter will generate, however the reader can
read any of the formats listed below.
mimetype: application/x-microsoft.net.object.binary.base64
value : The object must be serialized with
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.soap.base64
value : The object must be serialized with
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.bytearray.base64
value : The object must be serialized into a byte array
value : The object must be serialized into a byte array
: using a System.ComponentModel.TypeConverter
: and then encoded with base64 encoding.
-->
Expand Down Expand Up @@ -1236,6 +1236,56 @@
<data name="AvoidReservedWordsAsFunctionNamesError" xml:space="preserve">
<value>The reserved word '{0}' was used as a function name. This should be avoided.</value>
</data>
<data name="UseConstrainedLanguageModeName" xml:space="preserve">
<value>UseConstrainedLanguageMode</value>
</data>
<data name="UseConstrainedLanguageModeCommonName" xml:space="preserve">
<value>Consider Constrained Language Mode Restrictions</value>
</data>
<data name="UseConstrainedLanguageModeDescription" xml:space="preserve">
<value>Identifies script patterns that are restricted in Constrained Language Mode. Constrained Language Mode limits the types, cmdlets, and .NET methods that can be used to help secure PowerShell in environments requiring additional restrictions.</value>
</data>
<data name="UseConstrainedLanguageModeAddTypeError" xml:space="preserve">
<value>Add-Type is not permitted in Constrained Language Mode. Consider alternative approaches if this script will run in a restricted environment.</value>
</data>
<data name="UseConstrainedLanguageModeComObjectError" xml:space="preserve">
<value>New-Object with the COM object '{0}' is not permitted in Constrained Language Mode. Consider alternative approaches if this script will run in a restricted environment.</value>
</data>
<data name="UseConstrainedLanguageModeXamlError" xml:space="preserve">
<value>XAML usage is not permitted in Constrained Language Mode. Consider alternative approaches if this script will run in a restricted environment.</value>
</data>
<data name="UseConstrainedLanguageModeDotSourceError" xml:space="preserve">
<value>Dot-sourcing may be restricted in Constrained Language Mode depending on the source location. Ensure scripts are from trusted locations if running in a restricted environment.</value>
</data>
<data name="UseConstrainedLanguageModeInvokeExpressionError" xml:space="preserve">
<value>Invoke-Expression is restricted in Constrained Language Mode. Consider alternative approaches if this script will run in a restricted environment.</value>
</data>
<data name="UseConstrainedLanguageModeNewObjectError" xml:space="preserve">
<value>New-Object with type '{0}' is not permitted in Constrained Language Mode. Consider using an allowed type.</value>
</data>
<data name="UseConstrainedLanguageModeConstrainedTypeError" xml:space="preserve">
<value>Type constraint [{0}] is not permitted in Constrained Language Mode. Consider using an allowed type.</value>
</data>
<data name="UseConstrainedLanguageModeTypeExpressionError" xml:space="preserve">
<value>Type expression [{0}] is not permitted in Constrained Language Mode. Consider using an allowed type.</value>
</data>
<data name="UseConstrainedLanguageModeConvertExpressionError" xml:space="preserve">
<value>Type cast [{0}] is not permitted in Constrained Language Mode. Consider using an allowed type.</value>
</data>
<data name="UseConstrainedLanguageModeMemberAccessError" xml:space="preserve">
<value>Member '{1}' accessed on type [{0}] which is not permitted in Constrained Language Mode. Consider using an allowed type.</value>
</data>
<data name="UseConstrainedLanguageModeClassError" xml:space="preserve">
<value>PowerShell class '{0}' is not permitted in Constrained Language Mode. Consider using alternative approaches such as hashtables or PSCustomObject.</value>
</data>
<data name="UseConstrainedLanguageModeWildcardExportError" xml:space="preserve">
<value>Module manifest field '{0}' uses wildcard ('*') which is not recommended for Constrained Language Mode. Explicitly list exported items instead.</value>
</data>
<data name="UseConstrainedLanguageModeScriptModuleError" xml:space="preserve">
<value>Module manifest field '{0}' contains script file '{1}' (.ps1). Use a module file (.psm1) or a binary module (.dll) instead for Constrained Language Mode compatibility.</value>
</data>
<data name="UseConstrainedLanguageModePSCustomObjectError" xml:space="preserve">
<value>[PSCustomObject]@{{}} syntax is not permitted in Constrained Language Mode. Use New-Object PSObject -Property @{{}} or plain hashtables instead.</value>
<data name="UseConsistentParametersKindCommonName" xml:space="preserve">
<value>Use correct function parameters definition kind.</value>
</data>
Expand Down
Loading
Loading